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RE. DMCA - Anticircumvention Regulations 
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Legally Speaking 


Pamela Samuebon 

Why the Anticircumvention 
Regulations Need Revision 

Like a tempest in a teapot , the storm rages on 
over DMCA's ambiguous provisions . 


E very vision o: die digital 
future foresees copyrighted 
concent widely available via 
global networks. There is consid- 
erable debate, however, about rhe 
excenc to which this contenT will 
or should be distributed in 
cncrypred cr other technologi- 
cally protected form, and avail- 
able only with permission from 
the rightsholder. 

A nighly charged aspect of this 
debate is whether technical protec- 
tion systems will undermine the 
publics right to exercise fan uses of 
copyrighted works and its access to 
published information. In the L\$. ; 
this debate was an integral pan of 
the struggle over the anrdreumven- 
tion provisions of the Digital Mil- 
lennium Copyright Act (DMCA) 
enacted in October 1996. The 
DMCA makes it illegal to circum- 
vent access controls used by copy- 
right owners tn protect their works 
as well as to develop and distribute 
circumvention technologies. When 
enacting the DMCA, Congress 
believed it was doing everything 
possible to preserve fair use and 
public access to information while 
at the same time protecting the 
copyright industries against high- 
tech “burglars’ tools.* This column 
argues rhat this balanced objective 
may not have been achieved. 


It would oversimplify the 
facts— although not by much— 
to say that the battle in Con- 
gress over the anticircumvention 
provisions of the DMCA was 
pan of a larger war berween 
Hollywood and Silicon Valley. 
Hollywood and its allies sought 
a broad ban on the act of cir- 
cumventing a technical protec- 
tion system and on 
circumvention- 
enabling 
devices. Sili- 
con Valley 
firms and 
their allies 
generally 
opposed this 
broad ban. in parr, 
because it would 
have outlawed 
reverse engi- 
neering. com- 
puter security 
testing, and 
encryption 
research. Silicon 
Valley firms supported 
legislation ro outxaw act* o' cir 
cumvention facilinnng copy- 
right infringement and would 
have supported narrowiv drawn 
device legislation. However. b> 
colorful use of rhetoric and 
forceful lobbying, Hollywood 


and its allies were largely suc- 
cessful in persuading Congress 
to adopt broad anticircumven- 
tior. legislation. 

Given the administration s 
enthusiasm for the strong eco- 
nomic performance of rhe IT 
sccrox, and given rhe principles 
die administration endorsed in 
its 1 99? framework for global e- 
commerce, one might have 
expected the administra- 
tion to take a more 
balanced position on 
the anticir- 
cumvcnrion 
issues^ 

One can 
call the 
DMCAs 
anricircum- 
vention pro- 
visions many 
things, bur one 
cannot honestly speak 
of them as “predictable, 
minimalist, consistent, 
and simple" components of 
2 legal environment for e-com- 
merce, as the framework princi- 
ples suggested they should be. 
The administration instead 
tided with Hollywood on a key 
information policy issue and Sil- 
icon Valley will likely suffer as a 
result. 
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The DMCA’s 
Anticircumyention Rules 

There axe three antidrcumvention 
provisions in the DMCA. The * 
first is section 1201(a)(1) (A), 
which generally outlaws the act of 
circumventing “a Technical mea- 
sure chat effectively controls access 

m 

to a work protected under this 
title.” This rule is subject to seven 
statutory exceptions and will not 
take effect uncil October 2000, in 
part to allow a study to be con- 
ducted of the potential impact of 
this norm on noninfringing uses 
of copyrighted works. 

Section 1201 also contains two 
“antidevicc” provisions. Sections 
1201(a)(2) and i201(b)(i) both 
regulate technologies with circum- 
vention-enabling capabilities. The 
former pertains to technologies 
that “effectively control access to 
[copyrighted] works”; the latter 
pertains to technologies that 
“effectively protect a right of a 
copyright owner ... in a work or a 
portion thereof.” As to each, sec- 
tion 1201 stares that “no person 
shall manufacture, import, offer to 
the public, provide, or otherwise 
traffic in any technology, product, 
service, device, component, or 
part thereof” if it has one or more 
of the following characteristics:* (i) 
i? it is ’‘primarily designed or pro- 
duced for the purpose of circum- 
venting [technical] protection*' ; (2) 
if it has “only limired commer- 
cially significant purpose or use 
other chan to circumvent [techni- 
cal] protection *; and (3) if it is 
“marketed by that person or 
another acting on its behalf with 
that person's knowledge for use in 
circumventing technical protec- 
tion." The antidevitr rules have a 
narr ower range of statutory 
exceptions. 


Although administration offi- 
cials admitted in congressional tes- 
timony that its preferred 
legislation went beyond what the 
World Intellectual Property Orga- 
nization (WIPO) Copyrighr 
Treaty required, it argued for this 
broader ruie in pan to set a stan- 
dard for other countries to follow. 
Proponents of the administrations 
preferred anticircumvention regu- 
lations scoffed at arguments made 
by an alliance of consumer elec- 
tronics firms and computer and 
software industry companies 
about the harm likely to result 
from broad antidrcumvemion 
regulations. They also dismissed as 
specious arguments made oy 
library and educational groups 
about threats to fair use and the 
public domain arising from broad 
ar.ticircjmvcntion regulations. 

Yet, Congress eventually heeded 
some of these concerns. 

Exceptions to the Act-of- 
Circumvention Ban 

Section 1201s circumvention -of- 
access-control provision is subject 
to seven specific exceptions, as 
well as being qualified by several 
other subsections. While these 
exceptions and limitations 
respond to the gravest of concerns 
expressed by digital economy 
firms, they are narrowly crafted 
Congress may eventually need to 
revue this provision to recognize a 
broader range of exceptions. 

The administration inicialiv 

4 

sought to an almost unlimited ban 
of circumvention activities. The 
only exception in the administra- 
tions favored legislation was co 
enable circumvention of technical 
protection systems for legitimaxc 
law enforcement, inrel%nce, and 
other governmental purposes. 


Without this exception, suspected 
Mafia bosses and terrorists, oddly 
enough, might have been able co 
challenge attempted law enforce- 
ment or intelligence agency 
decryption of their records or 
comrauriicatiofts. 

The administrations favored 
bill also included a provision seat- 
ing that nothing in Section 1201 
would “affect rights, remedies, 
limitations, or defenses to copy- 
right infringement, including fair 
use, under this tide." Taken at face 
value, this provision seemed ro 
recognize char circumventing a 
technical protection system for 
purposes of engaging in fair use or 
ocher noninfringing acts is lawful. 

Yet some copyrighr industry repre- 
sentatives argued that fair use 
should nor be an acceptable rea- 
son to “break” a technical protec- 
tion system used by copyright 
owners to protect their works, 
likening this act ro burglary. How- 
ever, the legislative history of the 
DMCA dearly reflects that Con- 
gress incended for circumvention 
for fair use purposes co be lawful. 

Digital economy firms and 
their allies eventually persuaded 
Congress to create six additional 
provisions co the act-of-circum- 
vencion ban. One enables circum- 
vention for purposes of achieving 
interoperability among computer 
programs. A second authorizes 
legitimate encryption research. A 
third privileges some computer 
security texting. Other exceptions 
responded to nonprofit group 
concerns. One, for example, pro- 
vides a limited privilege ro circum- 
vent technical protections to 
ensurrperso ml privacy. Another 
provision clarifies chat software 
me hardware manufacturers are 
under no obligation to specifically 
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Legally Speaking 


design their products to respond 
to particular technical measures. 

However, Congress should have 
added a general-purpose “or ocher 
legitimate purposes'* exception pro- 
vision to Section 1201, recognizing 
many ocher legitimate reasons for 
circumvenring technical protection 
systems that arc not, strictly speak- 
ing, covered by the exceptions in 
the final bill (for iruance, to deter- 
mine if encrypted code transmitted 
via the Internet contains a destruc- 
tive computer virus or an infring- 
ing copy of ones intellectual 
property). Without such a provi- 
sion, courts will have to contort 
the law or reach unjust results. 

A general-purpose exception 
would add flexibility, adaptability, 
and fairness to the law. In many 
other parrs of copyright law — with 
die fair-use doctrine, for example, 
or the distinction between 
and expressions — Congress has 
trusted the common-law process to 
distinguish between legitimate and 
illegitimate activities. It should 
have done so with respect to the 
anrieixeumvention rules as well. 

Fair Use and the 
Antidevice Rules 

The most puzzling aspect of Sec- 
tion 1 20 1 is whether Congress, in 
essence, created a number of 
meaningless privileges or whether 
it intended for people to be able to 
develop or have to tech- 
nologies necessary to engage in 
privileged circumvention *5. Only 
three of the exceptions to the act- 
of-circum ven cion rule specifically 
aurhorize the creation of tools nec- 
essary to achieving a legitimate cir- 
cumvention activity (the encryption 
research, computer security, and 
interoperability privileges). The 
interoperability privilege exempts 


necessary tools from both antidc- 
vice provisions of Section 1201, 
while the encryption and security 
research privileges exempt tools 
only from the access-control provi 
sion. Section 1201 says nothing 
about enabling the development 
or distribution of circumvention 
tools to enable fair use or other 
privileged uses. 

How could Congress have 
expressly provided a right to 
“hack* a technical protection sys- 
tem to make fair uses without also 
allowing the development of tools 
necessary to effectuate fair uses? 
Under some readings of Section 
1201(b)(1), a computer scientist 
who develops software enabling 
fair use of a lawfully acquired copy 
of technically protected material 
would violate the statute, regard- 
less of whether he or she subse- 
quently distributed that software 
to anyone. 

Interestingly, it has long been 
lawful in the U.S.- — at least until 
the DMCA — to make and distrib- 
ute software designed to defeat a 
technical protection system neces- 
sary co enable noninfringing uses 
of copyrighted works. Quaid's 
Ramkey software program was 
designed to defeat Vault $ Prolok 
copy-protection software. By 
spoofing Vaults copy-protect sys- 
tem, Quaid’s customers could 
make unauthorized copies of the 
third-party software protected by 
Vaults program. Quaid success- 
fully defended against Vault s 
copyright lawsuit by showing char 
Ramkey had a substantial nonin- 
fringing use, namely, to enable 
users to effectuate their rights 
under copyright law to make 
backup copies. 

It is not dear how Vault us. 

Quaid would be decided in the 


post-DMCA environment. On 
the one hand, the DMCA seems 
to oudaw technologies if thei: pri- 
mary purpose is to circumvent a 
technical protection measure that 
effectively protects a right of a 
copyright owner. On the ocher 
hand, the DMCA recognizes that 
fair-use-like circumventions should 
be lawful. Backup copying is a 
specially privileged activity in the 
copynghr statute. Since a copy- 
right owner doesn't have a statu- 
tory righr to control backup 
copying, perhaps a spoofing tech- 
nology intended to enabie backup 
copying should be outside the 
statute. It is important co under- 
stand that dreumvenrion for 
backup copying or ocher fair-use 
purposes cannot occur without 
access to such a technology. 

Privacy v*. Security 

Intel has reeendy developed a line 
of semiconductor chips with a 
built-in identification system for 
each processor. Privacy advocates 
assert that processor identification 
systems threaten personal privacy 
on the Internet. In response, Intel 
announced it intended to ship 
these chips with the processor 
identity function "off." Suppose, 
however, that Microsoft develops 
Windows 2000 as a trusted system 
technology to run on rh«* particu- 
lar line of Intel chips and that 
* Microsoft requires licensees of 
Windows 2000 to agree to keep 
the In cel identification system on 
at all times. Microsoft might assert 
that the identifier is a critical com- 
ponent of its crusted system tech- 
nology. Suppose further that 
Windows 2000 will not install 
until the Intel identifier is on, and 
that the installation software, after 
a user dicks T agree” to the condi- 
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To limit on assessment of the circumvention 
ban to a certain range of possible 
effects ignores the wider swath of harm the 
antiarctimverrtion rules may cause. 


cions of the license, will actually 
activate the identifier. Assume fur- 
ther that a privacy advocacy group 
develops and distributes software 
that would "spoof" Windows into 
thinking the Intel identifier was 
on when ir was not in order to 
protect user privacy. Would the 
privacy group have violated Sec- 
tion 1201(b)(1)? 

Under a very stria interpreta- 
tion of 1201(b)(1), development 
of this spoofing software would 
seem illegal. It is, however, diffi- 
cult to believe judges would find 
this software violates the DMCA 
antidevice rules. They might 
observe the DMCA authorizes cir- 
cumvention m order to protect 
personal privacy. Therefore, Con- 
gress must have inrended for peo- 
ple to be able to develop or use 
technology ro accomplish the 
privileged privacy act. This is 
clearly nor the kind of black box 
circumvention device that Con- • 
gress had in mind when adopting 
DMCA. Microsoft should not be 
able to employ die anridreumven- 
rion provisions of DMCA to force 
trusted system technology on the 
public 

Othtr Harms Caused by 
the Antidevice Rules 

When testifying before Congress, 
proponents o t the administrations 
jnndevice rules repeatedly empha- 
sized that the legislation was 
needed to scop deliberate and sys- * 


temacic piracy by black box 
providers. Yet, the anbdcvice provi- 
sions adopted by Congress are far 
br o a der They provide a basis for 
challenging a wide range of tech- 
nologies chat arguably have circum- 
vention-enabling uses. This creates 
a potential for ‘“strike suits" by ner- 
vous or opportunistic copyright 
owners who might challenge the 
deployment of a new IT cool with 
capabilities chat may include ar- 
cum venrion of some technical pro- 
tection system. No doubt some 
expert might say chat deployment 
of a particular technology in the 
market would meet one of the 
three conditions in the antidevicc 
provisions, giving plausibility to the 
suit. Weak as such testimony might 
be. it may be enough to extract a 
settlement sum from the IT firm 
targeted. 

The potential for strike suits 
becomes stronger if one realizes it 
is not necessary (or arguably even 
relevanr) to litigation under the 
antidevice provisions of DMCA 
for any aa of underlying infringe- 
ment (for example* illegal copying 
of a protected work) to have ever 
taken place. Consider, for exam- 
ple, a recent lawsuit brought by 
Sony against Connectix. the 
maker of emulation software due 
permits games initially developed 
for Sony's Playstation to be played 
on LMac computers. Relying on 
the DMCA antidevicc provision, 
Sony is seeking up to $25,000 per 


unit sold by Connectix because 
the emulation software allegedly 
bypasses an anticopying feature in 
the games. Sony does nor need to 
allege or prove any actual illegal 
copying by users of the Connectix 
software. • 

Broad Study Needed 

The DMCA provides for a rwo- 
yeax moratorium on enforcement 
of the aa-of-tircumven non ban 
during which the Library of Con- 
gress is supposed ro study whether 
the ban is likely ro impede nonin- 
fringing uses of copyrighccd 
works. If the Library determines 
thar noninfringing uses will be 
adversely affected, it can waive the 
act-of-circuravenrion rule as to 
affected works or users. Similar 
studies are supposed to be carried 
our every three yean thereafter. 

The Library of Congress is sup- 
posed to consider. ~(i) the avail- 
ability for use of copyrighted 
works, (ii) the availability for use 
of works for nonprofit archival, 
preservation, and educational pur- 
poses, (iii) the impact [of] the 
prohibition ... on criticism, com- 
ment, news reporting, teaching, 
scholarship, or research, (and] (iv) 
the effect of circumvention of 
technical measures on the market 
for or value of copyrighred 
works." The library also has 
authority to consider "such other 
factors as the Librarian considers 
appropriate." Even though the 
Library can exempt certain classes 
of men or works from the act-of- 
urcumvention ban, the DMCA is 
Quite dear that the Library's deter- 
mmanom cannor be asserted as a 
eJefense-co an antidevice dajm. 

Nor does the Library have power 
to tdl copyright owners to stop 
using technical protection systems 
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if these system* arc impeding non- 
infringing uses, 

'W'hile the study provisions in 
DMCA axe surely berrer than 
nothing, they fell fer short of the 
periodic review and reporting 
process needed given the unprece- 
dented nature of the circumven- 
tion and the ancidevice bans. To 
limit an assessment of the circum- 
vention ban ro a certain range of 
possible effects ignores the wider 
swath of harm the ancicircumvcn- 
tion rules may cause. To assess the 
circumvention ban withour consid- 
ering the antidevice rules is ro 
overlook the most significant pro- 
vision in rhe DMCA. Unless con- 
strued narrowly, the anddcvice 
provisions of the DMCA may do 
as much harm to competition and 
innovation in the IT industry as 
the circumvention ban may do to 
noninfringing uses. 

One would chink Congress and 
the administration would be con- 
cerned about deleterious impacts 
of the anricircuxnvemion regula- 
tions on the IT sector given that 
this is the sector whose Tremen- 
dous growth the Commerce 
Department has been trumpeting 
tn the world. The Library of Con- 
gress should, therefore, decide that 
its srudies can consider the impact 
of anddevice rules on the ability of 
certain classes of users or works to 
make noninfringing uses of pro- 
tected works. The Library should 
also consider other unintended 
side-eflfects of the antidreumven- 
cion regulations. In order for this 
to happen, the Library needs to 
hear from the computing commu- 
nity on these issues. 

Conclusion 

Antidrcumvention regulations 
were contentious in the U.S. Con- 


gress and ar the diplomatic confer- 
ence leading up to adoption of the 
WIPO Copyright Treaty. The 
main concerns expressed in bom 
venues were: the harmful effecr 
such rules would likely have on 
public access ro information and 
or* the ability to make noninfring- 
ing uses of copyrighted works, and 
the harmful effecr such rules 
mighr have on competition and 
innovation in the market for hard- 
ware and software products whose 
uses indude bypassing technical 
protection systems. 

The diplomatic conference had 
the good sense to adopt only a 
general norm on circumvention 
activities, leaving nations free to 
implement this norm in their own 
way. The flaws in che DMCAs 
anodreumvendon provisions do 
not derive from the Treaty, bur 
rather from the bad judgment of 
the administration and the major 
copyright industry groups char 
urged adoption of these overbroad 
rules. 

The DMCAs antidrcumven- 
tion rules envision an information 
society very different from the one 
wc currently inhabit. People arc 
used to making a wide range of 
uses of copyrighted works without 
seeking rhe copyright owners per- 
mission. It is unclear bow well 
they will react to a radical shift in 
the market for information prod- 
ucts that the encryption-enrap- 
tured futurists are trying cc build. 
NYU Law professor Yochai Bon- 
der observes chat “(wje have no 
idea how a world in which infor- 
mation goods are perfectly exdud- 
able — as technical protection 
measures promise co nuke them — 
will look. Becaus e of the nonrival 
narure of information, prevailing 
economic theory would suggest 


that we are as likely to lose as to 
gam productivity* from this tech- 
nological change* [l]. In addition, 
if consumers wont buv tightly 
restricted copies, copyright owners 
may end up worse off than before. 
Branko Gera vac. a professor at 
MIT, urges copyright owners co 
"protect revenues, not bits" [2*. 

If concenr providers believe chat 
a good business model is the best 
way to protect intellectual prop- 
erty from market-destructive 
appropriations, perhaps the cur- 
rent debate over the DMCAs anti- 
circumvenrion regulations will 
seem in time like a tempest in a 
teapot. Ln che meantime, the 
impact of this legislation should Be 
closely watched because of the 
harmful consequences for the 
computer and software industries 
and for the public ar large. D 
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